Microsoft Issues Emergency Patch Amid Targeted Attacks

A newly discovered and critical security flaw in the Windows implementation of the Kerberos authentication scheme is being used in targeted attacks, prompting Microsoft to release an out-of-band patch today, one week after its regular Patch Tuesday cycle.

Microsoft is urging the immediate patching of domain controllers for this new Windows Kerberos elevation of privilege vulnerability, MS14-068, which has been seen being abused in "limited, targeted attacks," according to the software giant. The bug could allow an attacker to elevate an unprivileged domain user account to a domain administrator account, and ultimately take control of domain controllers or other servers in the server domain. The bug in the Kerberos Key Distribution Center affects Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.

"The main risk of this vulnerability is that an attacker who breached a particular system in an organization could use this vulnerability to move, not only laterally between systems using credentials pilfered from the initial compromise, but... also escalate privileges and gain access of remote systems as an administrator," says Johannes Ullrich, director of SANS Internet Storm Center.

Microsoft doesn’t usually rate privilege escalation as "critical" -- nor does SANS -- he says, but because this flaw attacks the Kerberos authentication system used in organizations, it's more serious. Ullrich says privilege escalation rarely gets the critical rating because the step of escalating user privilege alone doesn't lead to a compromise.

"Privilege escalation itself doesn't lead to compromise. It requires another -- typically 'critical' -- vulnerability first," he says. "For example, an arbitrary code execution vulnerability, which is usually rated critical."

Despite Microsoft's recommendations of escalated patching, Ullrich says, given the high volume of security patches from Microsoft this month as well as problems with some of them, it's probably best to test it first and wait a week before deploying it. "I consider this bug critical," he says, but doesn't need to be patched in a rush.

The attacker basically exploits the bug by sending a forged Kerberos ticket to the Kerberos Key Distribution Center (KDC), and the KDC then validates it and the attacker can do harm. Once the attacker gets domain admin credentials, he or she can install programs, alter or delete data, and create new accounts, for example.

"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed," Joe Bialek of MSRC Engineering said in a post today on the technical details of the flaw. "Therefore it is critical to install the update immediately."

A patch is also available for Windows Vista, Windows 7, Windows 8, and 8.1 machines, in what Microsoft calls "a defense-in-depth" approach, because they aren't vulnerable to the flaw, but they could ultimately be in harm's way in such an attack.

"The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit," said Bialek. "Non-domain controllers running all versions of Windows are receiving a 'defense in depth' update but are not vulnerable to this issue."

[No patches released for the now-unsupported XP even though the 19-year-old OLE bug is critical and the "Winshock" bug in Windows' SSL/TLS installation could be worse than Heartbleed. Read Microsoft Fixes Critical SChannel & OLE Bugs, But No Patches For XP.]

Meanwhile, Microsoft also issued an update to the problematic MS14-066 SChannel patch that it first released last week.